Executive brief
The Linux kernel's MediaTek power domain management code contains an uninitialized variable bug that could cause kernel crashes or incorrect device power state management. When attaching a device, the code reads a potentially invalid pointer before setting it, risking memory corruption or system instability on affected platforms.
Technical details
The vulnerability is an uninitialized variable bug in the mtk_mfg_attach_dev() function within the MediaTek power domain driver (drivers/pmdomain/mediatek/mtk-mfg-pmdomain.c). The variable prev_o is read in a conditional check before being assigned in the loop body on the first iteration. If the uninitialized value happens to be non-NULL, the code dereferences a stale or invalid pointer, potentially causing a kernel fault or incorrectly skipping the first Operating Performance Point (OPP). The fix is trivial: initialize prev_o to NULL. The vulnerability was detected by Clang's -Wconditional-uninitialized warning and affects the power management path for MediaTek Graphics processors. Patches have been applied to the stable kernel tree.
Affected products
- Linux Linux kernel multiple versions with MediaTek power domain support (5.x, 6.x, 7.x series)
Timeline
- 2026-09-03: disclosed
- 2026-08-12: patched: upstream fix committed